Help with 1-1 Static NAT

[junglecom]

Hi All, I want create a one to one static NAT for 2 servers through a fortigate-VM firewall. Server 1 VIP: (192.168.2.2) -> Server 1 Private IP: (10.0.3.2) Server 2 VIP: (192.168.2.3) -> Server 2 Private IP: (10.0.3.3) I cant seem to figure this out without checking the NAT option in a incoming traffic policy. Tried to follow the Fortigate documentation, but to put it nicely, it is less comprehensible for sure. Thank you!

[rwpatterson]

What you wrote looks complete to me. Just make sure you use the Virtual IP definition as the target in the policy, you should be done.

[emnoc]

I cant seem to figure this out without checking the NAT option in a incoming traffic policy.

You don' t need to check/enabled the NAT option when using VIPs for DNAT ( inbound )

[ede_pfau]

This is a direct crosspost from http://support.fortinet.com/forum/tm.asp?m=95662 I think we should discuss the matter in the original thread. OP has not answered my question about routing yet.

[junglecom]

Yeah, originally it was intended as a log question but quickly turned into configuration question. I appologize

[junglecom]

Only way I can access the server from a public IP address is to check the NAT box on the policy. If I uncheck it I can no longer access the server (ssh or http). what could I be doing wrong here? Please see my original thread for all the details http://support.fortinet.com/forum/tm.asp?m=95662

[emnoc]

Your answer is in your route-table and here in the other thread. - create one default route to this port Remove that 2nd route, remove your check NAT enable block and you should be golden.

[emnoc]

Will you have 2 posts going on, you made changes from the original start of this thread. And you didn' t heed our earlier suggestion & guidance. If you have the vip setup correctly, you don' t need nat enabled A photo says a thousand words; So what is it. port 1 or port 2?

[junglecom]

Sorry I started my config over removing all unnecessary IPs, since I still am unable to get this working. Below is all my settings simplified (reposted). Anyone see what I am missing here? Thank you very much for your help! (VIP Updated)

[emnoc]

diag debug flow is your friend, try it and see what it tells you :)